I use a .htaccess
basic auth on my WC site to help prevent hackers accessing wp-login
, which works well... except with WooCommerce if a logged in customer wants to logout from their account - upon clicking the logout link - they are greeted by the Basic Auth popup asking them to "authorise" (generated by our .htaccess
).
On Woocommerce dashboard:
Hello MrTest (not MrTest ? Log out) << clicking on "Log out" brings up the Basic Auth login box.... how can we avoid that ?
Here is the content of our htaccess:
<FilesMatch "wp-login.php">
AuthName "Authorized"
AuthType Basic
AuthUserFile /home/user/.pswrdfile
require valid-user
</FilesMatch>
In WooCommerce settings, the Logout endpoint is: customer-logout
and the logout link URL shows:
example.com/shop/my-account/customer-logout/?_wpnonce=2e343434
So how to change the .htaccess
to allow wp-login.php?action=logout
to pass through the basic auth?
I tried this but it fails to work; I have Apache server with latest versions.
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-login.php$
RewriteCond %{QUERY_STRING} ^action=logout
RewriteRule ^ - [E=noauth]
<FilesMatch "^(wp-login.php)">
Options -Indexes +FollowSymLinks +MultiViews
AuthName "Protected page. If you are not allowed to be here, leave the page"
AuthType Basic
AuthUserFile "/etc/apache2/htaccess/myhtaccess"
Require valid-user
Order Deny,Allow
Deny from all
Allow from env=noauth
Satisfy any
</FilesMatch>